- Public - talk.mikrotik.com.au

Re: [MT-AU Public] LNS Function using L2TP and Multilink PPP
by Nick Pratley | Servers Australia 27 Aug '18

27 Aug '18

Hey Paul, I am sure it’s a tick box on the LNS side, saying allow multiple connections for this user. Have a look with a static user under ppp secrets? I’ll have a look at my config soon if it’s not there. Nick Pratley Senior Network Operator P: (02) 8115 8817 4 Amy Close, Wyong, NSW 2259 Need assistance? We are here 24/7 +61 2 8115 8888 --- original message --- > Sat, 25 Aug at 9:13 am, <paul(a)buildingconnect.com.au> wrote: > Hi Nick, > I am actually just trying to test with 2 NBN links which are handed off to my LNS as L2TP tunnels, I am using MT as the LNS which is working great, but just can't find any settings to enable MLPPP on the server side. > The client side is easy as you just add more interfaces into the PPPOE client configuration, and according to the doco as long as the server can do MLPPP it will work, but I can't find anything that actually confirms that. > I know on Cisco it's a simple matter of enabling multilink PPP, but I can't find anything on the Mikrotik which states that. > Regards > Paul > -----Original Message----- > From: Public [mailto:public-bounces@talk.mikrotik.com.au] On Behalf Of Nick Pratley > Sent: Saturday, 25 August 2018 8:58 AM > To: MikroTik Australia Public List > Subject: Re: [MT-AU Public] LNS Function using L2TP and Multilink PPP > Actually, on second thought - nothing says it needs to be vdsl or adsl to test, right? > Grab to routerboards and throw two Ethernet cables between them. Pull up a l2tp server / client over that :-) > Doesn’t really matter what’s in the middle, that is just tunnel switched. > You just need both ends. > On Sat, 25 Aug 2018 at 8:53 am, Nick Pratley <nick(a)npratley.net> wrote: >>> Yeah, you’ll need multiple interfaces on the client side to fully test >>> end to end, but no reason it shouldn’t work. On my tik lns I have the >>> option to allow mlppp per client. >>> >>> Have only tested between MikroTik client and Cisco lns though - so >>> cannot confirm that the setting works. >>> >>> On Sat, 25 Aug 2018 at 7:28 am, Damien Gardner Jnr >>> <rendrag(a)rendrag.net> >>> wrote: >>> >>>> I was going to say I'll test it.. But it looks like MLPPP on 'Tik is >>>> all mostly automatic, you just specify multiple interfaces on the >>>> PPPOE session >>>> - so I'd have to HAVE multiple VDSL links here, to test it, I think..? >>>> With the same interface specified twice, the link came up fine with >>>> no errors from either end though.. >>>> >>>> https://wiki.mikrotik.com/wiki/Manual:MLPPP_over_single_and_multiple_ >>>> links >>>> Is the documentation for it.. >>>> >>>> On 24 August 2018 at 13:06, Philip Loenneker < >>>> Philip.Loenneker(a)tasmanet.com.au> wrote: >>>> >>>> > Hi Paul, >>>> > >>>> > Just to be clear - do you control all the equipment end to end, or >>>> > is >>>> it a >>>> > case of buying wholesale services off an upstream provider which >>>> > are delivered to your LNS? >>>> > >>>> > I haven't done anything with MLPPP, only "regular" PPP, but I >>>> > imagine >>>> that >>>> > it wouldn't take much to spin up a couple of PPPoE servers on one >>>> MikroTik, >>>> > and a couple of clients on another that is directly connected, to >>>> > test >>>> the >>>> > basic functionality before trying to do it over a more complex data >>>> path. >>>> > >>>> > I'm curious to hear any results you get, if you don't mind sharing >>>> > :) >>>> > >>>> > Regards, >>>> > Philip Loenneker | Network Engineer | TasmaNet >>>> > 40-50 Innovation Drive, Dowsing Point, Tas 7010, Australia >>>> > P: 1300 792 711 >>>> > philip.loenneker(a)tasmanet.com.au >>>> > www.tasmanet.com.au >>>> > >>>> > -----Original Message----- >>>> > From: Public <public-bounces(a)talk.mikrotik.com.au> On Behalf Of >>>> > Paul Julian >>>> > Sent: Friday, 24 August 2018 11:05 AM >>>> > To: 'MikroTik Australia Public List' <public(a)talk.mikrotik.com.au> >>>> > Subject: [MT-AU Public] LNS Function using L2TP and Multilink PPP >>>> > >>>> > Hi all, >>>> > >>>> > Just wondering if anybody has got Multilink PPP working when using >>>> > a MT router as an LNS using L2TP termination and PPPOE on the >>>> > client end, Mikrotik both ends ? >>>> > >>>> > I can't find any concrete doco on whether this actually works or >>>> > not, >>>> from >>>> > what I can find my thoughts are that maybe MT can do the client >>>> > MLPPP >>>> but >>>> > might not be able to handle the server side. >>>> > >>>> > Any thoughts ? >>>> > >>>> > Regards >>>> > Paul >>>> > _______________________________________________ >>>> > Public mailing list >>>> > Public(a)talk.mikrotik.com.au >>>> > >>>> http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com >>>> .au >>>> > >>>> > _______________________________________________ >>>> > Public mailing list >>>> > Public(a)talk.mikrotik.com.au >>>> > >>>> http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com >>>> .au >>>> > >>>> >>>> >>>> >>>> -- >>>> >>>> Damien Gardner Jnr >>>> VK2TDG. Dip EE. GradIEAust >>>> rendrag(a)rendrag.net - http://www.rendrag.net/ >>>> -- >>>> We rode on the winds of the rising storm, We ran to the sounds of >>>> thunder. >>>> We danced among the lightning bolts, >>>> and tore the world asunder >>>> _______________________________________________ >>>> Public mailing list >>>> Public(a)talk.mikrotik.com.au >>>> http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com >>>> .au >>>> >>> -- >>> >>> Kind Regards, >>> *Nick Pratley* >>> P: 0448 379 418 >>> E: nick(a)npratley.net >>> >>> -- >> Kind Regards, >> *Nick Pratley* >> P: 0448 379 418 >> E: nick(a)npratley.net >> _______________________________________________ >> Public mailing list >> Public(a)talk.mikrotik.com.au >> http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au >> _______________________________________________ >> Public mailing list >> Public(a)talk.mikrotik.com.au >> http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au --- end of original message ---

5 17

LNS Function using L2TP and Multilink PPP
by Paul Julian 24 Aug '18

24 Aug '18

Hi all, Just wondering if anybody has got Multilink PPP working when using a MT router as an LNS using L2TP termination and PPPOE on the client end, Mikrotik both ends ? I can't find any concrete doco on whether this actually works or not, from what I can find my thoughts are that maybe MT can do the client MLPPP but might not be able to handle the server side. Any thoughts ? Regards Paul

4 7

conntrack timing for tcp session
by Alex Samad 23 Aug '18

23 Aug '18

Hi ROS has a default of tcp-established-timeout: 1d But I have asym routing and not all the routers will see syn nor fin. I am thinking of bringing this down to 2 hours to match up with linux timeout . currently i have keep alive set to 30 min on my linux boxes. I don't think there is any reason why this should cause an issue. ??? Alex

2 8

Planet VC-231G VDSL Modem
by Russell Hurren 16 Aug '18

16 Aug '18

Hi everyone I'd looked into using the Planet VC-231G VDSL modem with the NBN a while back, and the distributor told me that it wasn't tested and they didn't know if it would work. I've since read a bit more about it, and found this document (skip to page 43) - https://www.nbnco.com.au/content/dam/nbnco2/documents/sfaa-wba2-product-cat… I've asked Planet whether it meets the requirements, and they just told me that it uses a Metanoia MT5311GB VDSL2 Chipset and a Qualcomm QCA8337N Gigabit Ethernet Chipset and suggested that I test it. I'm aware that Duxtel and others have been looking at SFP modules with Metanoia chipsets, and was wondering if anyone would know whether the VC-231G would be likely to work with the NBN? I don't believe there's any compliance issues, the only question is whether it works. The Planet device looks more professional than the alternatives (eg Draytek Vigor 130), so I'd rather use it if it'll work. I had a Telstra technician tell my client that the TP-Link TD-8817 ADSL bridges I supplied mightn't be able to cope with the number of users on the network (because he didn't understand the difference between a router and a bridge). Regards Russell

2 1

rate limiting - shapping
by Alex Samad 16 Aug '18

16 Aug '18

Hi Okay - say I have a CCR 1072. 1 interface connected to TPG say 100M connections (int A) 1 interface into my vlan where my firewall is connected. (int B) I want to shape / limit / ?? in boud and out bound traffic. I believe - from a quick read of the routeros pages that I apply the limiter to the int B. and apply up and down for 100Mb/s - this is the max Then I can carve out - well what I want is from 1 ip I want to allow full 100Mb. from 2 other I want to allow up to 80Mb and for the rest up to 60Mb/s I think I create a tree of shappers the top being the full capacity and then add nodes to match each of the above. plus I don't want drop I want it to hold the packects and release when it can does that sound about right ? A

4 7

LtAP Mini Kit
by Dave Browning 02 Aug '18

02 Aug '18

Hi All, Looking for anyone with an LtAP mini kit who can check if they have the same problem as I. If I power from USB port, the lte interface doesn't come up when WiFi is enabled - If I power from PoE or AC, works fine. Cheers, Dave Browning | Network Engineer P 1300 791 678 Level 1, 12 Railway Tce, Milton QLD 4064

3 3

CGN Nat 444 on CCR1072
by Matt Perkins 01 Aug '18

01 Aug '18

Hi All, I have been tasked with implementing NAT444 on a 1072 does anybody have any idea what the expected throughput would be with 65025 NAT rules. Matt. -- /* Matt Perkins Direct 1300 137 379 Spectrum Networks Ptd. Ltd. Office 1300 133 299 matt(a)spectrum.com.au Level 6, 350 George Street Sydney 2000 Spectrum Networks is a member of the Communications Alliance & TIO */

3 3

Re: [MT-AU Public] SIP Identification issue in mangle and queues
by Nick Pratley | Servers Australia 25 Jul '18

25 Jul '18

Hey Paul, How are you talking to MyNetPhone? Do you have dedicated cross connects to them, or are you just talking over the internet? If it's over the internet, its the general consensus is that DSCP gets remarked to 0 through all providers - so it'd only be used within your network toward the upstream and down to your customer. Probably also why you won't see any markings from MyNetPhone inbound on your transit links. If you're just trying to QOS your last mile circuits so large downloads etc don't break SIP - can you move that to customer access device? Not sure what phones you are using but Polycom/Cisco/Yealink can all mark their RTP / Signal traffic with different markings. You could match these markings from your customer on your LNS and add those addresses to an address list with a ~15 minute timeout. You could then match that address list on your inbound interfaces from the internet and remark internally before routing to your customer site over last mile access. Obviously that'd mark everything for those IPs down to the customer and not just RTP - however if the provider only uses them for RTP, I don't really see the issue. Regards, Nick (p.s. Sorry for signature in advanced - it's enforced outbound on our MTA, just subbed personal email to this list so next reply won't have it - I promise) --- original message --- On Wed, Jul 25, 2018 at 04:53 pm, <paul(a)buildingconnect.com.au> Paul Julian wrote: Well I found the problem I think, I am still working out how to get around it though. It seems that mynetfone use different servers for their signalling and RTP, which means if you use the sip service type in Mikrotik, or port 5060/5061 to mark your packets then you will miss the RTP traffic which is really what you need to get. Somehow I need to mark packets that are related to the SIP connection, not just the SIP connection itself. I will have to have a think about this one..... Regards Paul -----Original Message----- From: Public <public-bounces(a)talk.mikrotik.com.au> On Behalf Of Philip Loenneker Sent: Wednesday, 25 July 2018 2:41 PM To: MikroTik Australia Public List <public(a)talk.mikrotik.com.au> Subject: Re: [MT-AU Public] SIP Identification issue in mangle and queues Fair call :) Are your mangle rules not matching, or only the queue not matching? -----Original Message----- From: Public [mailto:public-bounces@talk.mikrotik.com.au] On Behalf Of Paul Julian Sent: Wednesday, 25 July 2018 2:18 PM To: 'MikroTik Australia Public List' <public(a)talk.mikrotik.com.au> Subject: Re: [MT-AU Public] SIP Identification issue in mangle and queues Hi Philip, Quite honestly we wouldn't trust any provider with DSCP values, they just don't get it, we mark everything based on connection type and/or ports and also pickup SIP servers dynamically based on those other criteria. The problem comes when we mark the packets they seem to get marked but the way we see them treated in queues is strange, they seem to have a bursty nature rather than having a consistent 80kbit/s sort of situation. There is something strange going on but it is only affecting this one customer who uses mynetfone, so I am trying to think outside the box and wondering what on earth could be happening to cause this. Regards Paul -----Original Message----- From: Public <public-bounces(a)talk.mikrotik.com.au> On Behalf Of Philip Loenneker Sent: Wednesday, 25 July 2018 2:14 PM To: MikroTik Australia Public List <public(a)talk.mikrotik.com.au> Subject: Re: [MT-AU Public] SIP Identification issue in mangle and queues Hi Paul, We have noticed that MyNetFone do NOT mark their packets with DSCP values, even if the handsets/softphones at the customer end do. You can see this clearly in torch and packet captures. We have asked them about it in the past, and didn't manage to get them to understand what DSCP was and why it was important. You may have more luck if you reach out to them, as it's been a while since we tried. If you do have some luck, please let me know so I can check our customers again :) Regards, Philip Loenneker | Network Engineer | TasmaNet 40-50 Innovation Drive, Dowsing Point, Tas 7010, Australia P: 1300 792 711 philip.loenneker(a)tasmanet.com.au www.tasmanet.com.au -----Original Message----- From: Public [mailto:public-bounces@talk.mikrotik.com.au] On Behalf Of Paul Julian Sent: Wednesday, 25 July 2018 1:33 PM To: 'MikroTik Australia Public List' <public(a)talk.mikrotik.com.au> Subject: [MT-AU Public] SIP Identification issue in mangle and queues Hi All, Just wondering if anybody has seen this anomaly before. We use Mikrotik routers as LNS’s in many locations, we prioritise VOIP traffic outbound to our customers and it works very well. We do this using a mix of mangle rules and reconstruct the customer facing queues during login, this also works very well and allows us to prioritise any voice provider not just ourselves. Just recently we had a customer advise that they were having voice issues and were wondering if they needed to increase their capacity, upon looking at their usage history we could see that they were spiking a bit but also noticed that their VOIP queue was not matching any packets. Other customers were matching just fine with the same rules in place, however we totally went through everything and couldn’t find any issues. As a precaution we upgraded the ROS to the latest bugfix version and also upgraded firmware. After that the other customers VOIP queues were still matching just fine so we thought perhaps Mynetfone were doing something a bit weird with the voice traffic to this customer, so we even setup a dedicated queue for this customer with everything needed to match the traffic, but still nothing. It’s a really weird problem, it’s only this one customer, all other customers are working correctly, so I’m not sure whether it’s a mynetfone problem or maybe the customers router, but we only prioritise the outbound traffic TO the customer and across our network but in this case it’s the traffic from mynetfone to the customer which isn’t matching, as such I wouldn’t think that their CPE could impact what we are doing in any way. Any thoughts would be appreciated, I am fast running out of my remaining hair on this one ૘ෞ਀ ഀ਀吀栀愀渀欀猀ഀ਀倀愀甀氀 _______________________________________________ Public mailing list Public(a)talk.mikrotik.com.au http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au _______________________________________________ Public mailing list Public(a)talk.mikrotik.com.au http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au _______________________________________________ Public mailing list Public(a)talk.mikrotik.com.au http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au _______________________________________________ Public mailing list Public(a)talk.mikrotik.com.au http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au _______________________________________________ Public mailing list Public(a)talk.mikrotik.com.au http://talk.mikrotik.com.au/mailman/listinfo/public_talk.mikrotik.com.au --- end of original message ---

2 1

SIP Identification issue in mangle and queues
by Paul Julian 25 Jul '18

25 Jul '18

Hi All, Just wondering if anybody has seen this anomaly before. We use Mikrotik routers as LNS’s in many locations, we prioritise VOIP traffic outbound to our customers and it works very well. We do this using a mix of mangle rules and reconstruct the customer facing queues during login, this also works very well and allows us to prioritise any voice provider not just ourselves. Just recently we had a customer advise that they were having voice issues and were wondering if they needed to increase their capacity, upon looking at their usage history we could see that they were spiking a bit but also noticed that their VOIP queue was not matching any packets. Other customers were matching just fine with the same rules in place, however we totally went through everything and couldn’t find any issues. As a precaution we upgraded the ROS to the latest bugfix version and also upgraded firmware. After that the other customers VOIP queues were still matching just fine so we thought perhaps Mynetfone were doing something a bit weird with the voice traffic to this customer, so we even setup a dedicated queue for this customer with everything needed to match the traffic, but still nothing. It’s a really weird problem, it’s only this one customer, all other customers are working correctly, so I’m not sure whether it’s a mynetfone problem or maybe the customers router, but we only prioritise the outbound traffic TO the customer and across our network but in this case it’s the traffic from mynetfone to the customer which isn’t matching, as such I wouldn’t think that their CPE could impact what we are doing in any way. Any thoughts would be appreciated, I am fast running out of my remaining hair on this one ૘ෞ਀ ഀ਀吀栀愀渀欀猀ഀ਀倀愀甀氀

2 5

Forward Chain firewall rules
by Paul Julian 20 Jul '18

20 Jul '18

Hi All, Just wondering what others do when it comes to jumping to new chains from the forward chain for protecting services running behind your Mikrotik running as a firewall. We typically jump to a new chain for stuff like SMTP servers or Web servers and then filter based on protocol and port within that new chain to protect boxes, then drop anything that doesn't match. Some people add an accept rule at the top of each of those chains for related and established connections, some people add one at the beginning of the default forward chain, what are peoples thoughts on the pros and cons of doing this in any way mentioned ?, are there any risks doing one way or another or should you just stick to allowing only the trusted ports and protocols through in each relevant chain rather than anything that's already been allowed previously ? I'm interested in peoples thoughts on this Thanks Paul

2 1